1. Field of the Invention
The present invention relates generally to Virtual Private Networks (VPN) based on Multiprotocol Label Switching (MPLS), and more particularly to redirecting or rerouting VPN traffic in response to an attack caused by an attacker flooding a victim's host system with one or more of several types of attack traffic.
2. Background of the Invention
In a Distributed Denial of Service (DDoS) attack, an attacker takes control of one or more hosts (daemons) and uses the daemons to send an enormous amount of traffic to a, for example, web site so that no other traffic can get through to the website. In essence, the website is clogged or jammed with traffic. The frequency of DDoS attacks in the Internet has grown in the past several years. The flooding of a victim's host system with attack traffic causes legitimate users of the victim's host system to be denied access to applications running on the System-Under-Attack (SUA). The application can be a web server, a file server, a Domain Name System (DNS) server, or other Internet related service or device. The legitimate users cannot access the application due to Central Processing Unit (CPU) and/or bandwidth exhaustion on the system under attack. An attack may have a distributed nature due to the attack traffic being from random, usually spoofed, source IP addresses and originating from many daemon hosts. Also, the attack traffic may enter the victim's Virtual Private Network (VPN) network from various entry points.
It is well known that DDoS attacks are among the most difficult types of attacks to defend against. A system is vulnerable to a DDoS attack simply by being connected to the Internet. The federal government is increasingly aware of DDoS attacks and may propose that federal agencies only utilize ISPs that have DDoS protection in their networks.
For a DDoS attack to be successful in a Multiprotocol Label Switched (MPLS) Virtual Private Network (VPN) environment, the master, daemons and the system-under-attack (the victim) have to belong to the same or mutually accessible VPNs. In many other respects, a DDoS attack in a MPLS VPN is similar to a DDoS attack in an IP network.